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Abstract. We analyze the value to e-commerce website operators of 
offering privacy options to users, e.g., of allowing users to opt out of ad 
targeting. In particular, we assume that site operators have some control 
over the cost that a privacy option imposes on users and ask when it is to 
their advantage to make such costs low. We consider both the case of a 
single site and the case of multiple sites that compete both for users who 
value privacy highly and for users who value it less. One of our main 
results in the case of a single site is that, under normally distributed 
utilities, if a privacy-sensitive user is worth at least y/2 — 1 times as much 
to advertisers as a privacy-insensitive user, the site operator should strive 
to make the cost of a privacy option as low as possible. In the case of 
multiple sites, we show how a Prisoner's-Dilemma situation can arise: In 
the equilibrium in which both sites are obliged to offer a privacy option 
at minimal cost, both sites obtain lower revenue than they would if they 
colluded and neither offered a privacy option. 



1 Introduction 

Advertising supports crucially important online services, most notably search. 
Indeed, more than 95% of Google's total revenue derives from advertising^] Other 
advertiser-supported websites provide a growing array of useful services, includ- 
ing news and matchmaking. Because of its essential role in e-commerce, online 
advertising has been and continues to be the subject of intensive study by di- 
verse research communities, including Economics and Computer Science. In this 
paper, we focus on an aspect of online advertising that has received little atten- 
tion to date: how website operators can maximize their revenue while permitting 
privacy-sensitive users to avoid targeted ads. 

Targeted ads are those chosen to appeal to a certain group of users. In con- 
textual targeting, ads are matched to search queries or other commands issued 
by users; because it does not entail the collection and mining of any information 
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except that which the user provides voluntarily and explicitly at the time the 
ad is placed, it is not usually viewed as intrusive, and few users try to avoid 
it. In demographic targeting, ads are matched to users' demographic categories 
such as gender, location, age, race, religion, profession, or income. Demographic 
targeting may involve considerable data collection and analysis, and it is more 
controversial than contextual targeting: Some users are uncomfortable about 
being categorized, feel more vulnerable to ads that make use of their demo- 
graphic categories, and worry that the same demographic information may be 
used for purposes more consequential and nefarious than advertising; other users 
appreciate the fact that their membership in certain demographic categories, 
particularly age, gender, and location, can prevent their being shown numerous 
time-wasting ads that are provably irrelevant to them. In behavioral targeting, 
ads are matched to individual users' browsing histories. By definition, it involves 
the collection and analysis of sensitive information, and many users take steps 
to avoid it. 

Unsurprisingly, targeted ads are more effective than generic, untargeted ads, 
and thus they fetch higher prices. Behavioral targeting, for example, has been 
shown to produce higher click-through rates than no targeting; estimates of the 
extent of improvement in click-through rates vary widely, however, from 20% 
in the work of Chen et al. [3] to a factor of six in the work of Yan et al. [TT] . 
Conversion rate, i.e., the fraction of those users who, after clicking through to 
the advertiser's site actually buy something, is also higher for targeted ads; see 
Bcales [T] for a discussion of the effect of behavioral targeting on conversion rates 
and Jansen and Solomon [7] on the effect of demographic targeting in general 
and gender in particular. Although efforts to quantify the effect of ad targeting 
on website operators' revenues are ongoing, there is credible evidence that the 
effect is large enough to imply that the elimination of targeted ads could mean 
the end of the Web as we know it; Goldfarb and Tucker [4], for example, studied 
the effect of EU privacy regulation on ad revenue and concluded that, all else 
equal, advertisers would have to spend approximately $14. 8B more annually to 
achieve the same effectiveness under a strict privacy regime {i.e., one that is less 
friendly to targeted ads) and that the dependence on targeted ads is highest 
among general-audience websites, such as those that provide news or weather. 

Because targeted ads are lucrative for website operators, users are being 
observed, categorized, and tracked ever more precisely. Understandably, some 
users fear loss of privacy, and various tools offered by website operators {e.g., 
opt-outs and other customizable privacy settings) and by third parties {e.g., 
anonymizing browser plug-ins such as TorbuttorQ that promise online-privacy 
protection are proliferating. These tools allow users to avoid targeted ads, but of 
course people who use them can still be shown generic, untargeted ads. Although 
many such tools are available without charge, they can impose non-monetary 
costs on users, e.g., time and effort spent figuring out the often obscure privacy 
options presented by a UI, time and effort spent on installation of new software 
such as a privacy-enhancing browser plug-in, and reduced ease of use, speed, 
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and/or quality of service. To a considerable extent, these costs can be controlled 
by website operators. 

We ask when it is to website operators' advantage to make the cost of such 
privacy options low. Our major contributions include: 

— Economic models in which to address the problem, both for the case of a 
single site and for that of multiple sites that compete both for users who 
value privacy very highly and for users who value it less. 

— A complete analysis of the case of a single site with homogeneous users and 
normally distributed utilities. In this setting, if a privacy-sensitive user is 
worth at least 0.4 times as much to advertisers as a privacy-insensitive user, 
the site operator should strive to make the cost of a privacy option as low 
as possible. 

— A complete analysis of the case of two sites with user demand functions that 
denote their privacy preferences. In this setting, we show how a Prisoner's- 
Dilemma situation can arise: In the equilibrium in which both sites are 
obliged to offer a privacy option at minimal cost, both sites obtain lower 
revenue than they would if they colluded and neither offered a privacy op- 
tion. 

2 Related Work 

To the best of our knowledge, we are the first to study the question of when it is 
to advantage of website operators to minimize the cost of providing users with 
privacy options. However, several related aspects of web users' ability to control 
their personal information have been studied. 

Riederer et al. [5] propose a market for personal information based on the 
notion of transactional privacy. Users decide what information about themselves 
should be for sale, and aggregators buy access to users' information and use it 
to decide what ads to serve to each user. The information market that con- 
nects users and aggregators, handles payments, and protects privacy achieves 
truthfulness and efficiency using an unlimited-supply auction. 

Carrascal et al. [2] use experience sampling to study the monetary value that 
users place on difference types of personal information. They find, for example, 
that users place a significantly higher value on information about their offline 
behavior than they do on information about their browsing behavior. Among 
categories of online information, they value financial and social-network infor- 
mation more highly than search and shopping information. 

Iyer, Soberman, and Villas-Boas [3] consider advertising strategies in seg- 
mented markets, where competing firms can target ads to different segments. 
They find that firms can increase profits by targeting more ads at consumers 
who have a strong preference for their product than at comparison shoppers 
who might be attracted to the competition. Interestingly, targeted advertising 
produces higher profits regardless of whether the firms can price discriminate. 
Moreover, the ability to target advertising can be more valuable to firms in a 
competitive environment than the ability to price discriminate. 



Telang, Rajan, and Mukhopadhyay 10J address the question of why multiple 
providers of free, online search services can coexist for a long time. In standard 
models of vertical (or quality) differentiation, a lower-quality product or service 
must sell for a lower price than its higher-quality competitor if it is to remain in 
the marketplace; if the prices are equal, all consumers choose the higher-quality 
alternative. Similarly, in standard models of horizontal (or taste) differentiation, 
sustained differentiation among products or services occurs when users incur 
high transportation costs. Yet, neither price nor transportation cost is a strate- 
gic variable in online search. Telang, Rajan, and Mukhopadhyay point out that, 
although the quality of one search service may clearly be higher than that of its 
competitors on average, the quality of results of a particular search by a partic- 
ular user is highly variable and inherently stochastic. Thus, there is a nontrivial 
probability that a user will be dissatisfied with the results of a particular search 
and wish to search again for the same information, using a different search ser- 
vice. It is precisely the zero-price, zero-transportation-cost nature of the user's 
task that may cause him to use more than one search service in a single session. 
In the aggregate, this feature creates residual demand for lower-quality search 
services, allowing them to coexist with their higher- quality competitor. 

3 Single-provider case 

We begin by presenting a general model of an ad-supported service with a single 
provider. Let n be the size of the market for this service (i.e., the number of 
users) , v be the revenue extracted by the service provider for each user that allows 
targeted ads (referred to below as a "targeted user"), and jv, with < 7 < 1, 
the revenue extracted for each user that avoids targeted ads (referred to below 
as a "private user"). The total revenue extracted by the provider is given by: 

r = nv(s + "fp), (1) 

where s is the fraction of the market that consists of targeted users, and p is the 
fraction that consists of private users. 

In this setting, we model the users by way of their utilities. For a specific 
user, the random variables U s and U p denote the utilities that the provider 
derives from the targeted and private services, respectively. We discount the 
utility by a cost c, which can be thought of as fixed cost that the user pays to 
set up the private option. In our model, we assume c is under the control of the 
service provider; hence, the provider will choose the cost of the privacy option 
to optimize revenuej^] We assume c > 0, but one could expand our analyses 
to include settings in which the provider "pays" users to use its service and 
thereby induces a negative cost c. Let U — (II s , U p ) be the corresponding joint 
distribution. Let f(x, y) — Pr[U s — x, U p — y] be the joint density, and similarly 
let F(x, y) = Pr[U ^ x, U p ^ y] be the joint distribution function. 

5 One could imagine more elaborate models, where the cost was governed by a distri- 
bution, and the provider could, for example, control the mean of the distribution; 
for simplicity, we focus on the constant-cost model in this first paper. 




Fig. 1: Optimal privacy-option setup 
cost and value for various 7 and n = 100, 
v = l. 



Fig. 2: The value of 7(0) - where the 
privacy option takes on zero cost - for 
three settings: U p, s mean fixed at 0, 
mean fixed at 0, and U p and II s 
have the same mean. 



A user may: 

1. use the targeted option and derive utility II s ; 

2. use the private option and derive utility U p — c; 

3. abstain from using the service for a utility of 0. 

Users choose among the above options to maximize their utility. Their choices 
determine the values of s and p. 

From the standpoint of the provider, finding the revenue-maximizing cost c* 
involves computing trade-offs between s and p. We have: 

00 c+y 

s = Pr[U p - II s < c, II s > 0] = J J f(x, y)dxdy, (2) 

-00 

00 00 00 

p = Py[U p - U s > c, U p > c] = J J f(x,y)dxdy+ J J f(x,y)dxdy. (3) 

c+y —00 c 

We emphasize that, in this model, s+p may be less than 1, because users with 
negative utility from both targeted and private options will not use the service 
at all. 



3.1 Normally Distributed User Utilities 

We now explore this model by considering the case of normally distributed user 
utilities. Assume that U = (U S ,U P ) follows a standard bivariate normal dis- 
tribution with mean vector zero and covariance matrix £ = {{1, p), {p, 1}}; 
here, p is the correlation coefficient between II s ', and U p . Use <p2 to denote 
U's density and ^2 to denote its distribution function. The marginal distribu- 
tions II s and U p are standard normal with mean 0, variance 1, density function 



4>{x) — -j= exp(— x 2 /2), and distribution function $(x) = \ [l + erf(a;/\/2)] . 
We first consider the case in which p = 0. 



3.2 Uncorrelated user utilities, p = 0. 

The fraction of targeted users is 

s = Pr[U p -U s <c,U s > 0] (4) 

oo c+y 

= J J <P(x)cj>(y)dxdy. (5) 

-oo 

Similarly, the fraction of private users is 

p = Pr[U p -U s >c,U p > c] (6) 

OO OO OO 

= J J <p(x)<f>(y)dxdy + J J cj)(x)<j)(y)dxdy, (7) 

c+y — oo c 

where erfc(x) = 1 — erf (a;). Observe that s is monotonically increasing in c, while 
p is monotonically decreasing in c. The rate of change of the fraction of targeted 
users as a function of c is: 
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which is easily seen to be decreasing in c. Using similar calculations, we can 
compute the rate of change of the fraction of private users with respect to c: 



dp 
dc 
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which is similarly increasing in c. The provider is indifferent with respect to 
revenue earned between the two types of users when: 



Denote by 7(c) the value of c for which equality holds. Substituting and solving 
for 7(c), we obtain: 

7(c) = 1- e2 ] ■ (15) 

We continue by proving an auxiliary lemma. 
Lemma 1. 7(c) in decreasing in c. 
Proof. Consider the derivative 

9eTerfc(|) 1 <£ „ /c\ I 



- ce 



erfc b --c- ( 16 ) 



dc 2 \2/ VtF 

We show that it is negative for all c > 0; this suffices to prove the lemma. Note 
the following equivalences. 



1 ^ r 

-ce 4 eric 



(2) */£ 



( < 4 ~ erfc ( - ) < 



si 2 
ce 4 — p= / e 

Vf ./c/2 

e~ 






(17) 


2 


(18) 


2 


(19) 


1. 


(20) 



c/2 

We prove the last line above, using the following bound of [5] (a tighter version 
of Komatsu's inequality 

e x j e~ t2 dt < 2/ fox + Vx 2 + 4 J . (21) 

At x = c/2, we obtain 

eT J e ~ t2 dt < 2/ (3c/2 + y/c 2 /* + 4 J , (22) 

which yields 

ceT y e -' 2 di < 2c/ (3c/2 + y/c 2 /4 + 4j < 1, (23) 

proving the lemma. □ 

We have that 7(0) = v2— 1 ~ 0.41. Furthermore, because 7(c) is decreasing 
in c, for any 7 > 7(0), it follows that the provider's best strategy is c = 0, i.e., 
offering a free privacy option. Using the above, we are now ready to state the 
main theorem of this section, corollary 



Theorem 1. If U follows a standard bivariate normal distribution with correla- 
tion p — 0, then the provider will offer a free privacy option whenever 7 > v2 — 1 . 



Remark 1. The specific value — 1 arises from our assumption that U p and U s 
were distributed according to a standard normal distribution of mean 0. Similar 
results for other means and variances can be calculated in a similar fashion. 
Figure [2] demonstrates three variations: where the mean of U p is fixed at but 
the mean of II s varies; where the mean of II s is fixed at but the mean of U p 
varies; and where the means vary but are equal. (All variances remain 1.) For 
example, where U and U p have equal means, we see that 7(0) converges to 1 
very quickly, as offering privacy cannibalizes more lucrative targeted users more 
readily than it garners new private users. 



3.3 Correlated utilities, p ^ 0. 

Assume that U = (U s , U p ) follows a standard bivariate normal distribution with 
correlation p. Use ^2 to denote its density function. We derive an indifference 



condition similar to the one in Equation 14 
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Substituting for the density function of the standard bivariate normal and inte- 
grating, we obtain an expression for 7 in terms of c and p: 



7 = 



V 



y/2 - 2pe ^p- 1 ) erfc 
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As before, setting c = yields 
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7(0) = 



l + V2-2p' 



(26) 



We observe that, as the correlation coefficient increases (reps., decreases) the 
value of 7 beyond which it makes sense to offer a privacy option at no cost also 
increases (reps., decreases). That is, greater correlation means one requires higher 
revenue from private use rs in order to offer privacy at no cost; in particular, when 
U p = II s , Equation 26 reasonably requires that 7(0) = 1. We can now state a 
generalized version Theorem [lj taking into account correlated user utilities. 

Theorem 2. IfU follows a standard bivariate normal distribution with correla- 
tion p, then the provider will offer a free privacy option whenever 7 > 1+ ^2-2p ' 



4 A two-player game 

We provide a general model of the two-player version of the game. We then 
explore the model by delving into a concrete example. Throughout this section, 
we use the terms "player" and "provider" interchangeably. As in the single- 
provider case, a "targeted user" is one who does not use the privacy option, and 
a "private user" is one who does. 

The game proceeds in two periods t = 1,2. To begin, at t = 1, we have 
two providers Si, for i = 1, 2, that offer competing, advertising-supported, non- 
private services. We let So denote a user's outside option, which in this case is 
to use neither service. Denote the fraction of users who choose Si at time t by 
s it . We have Yn=o s n = 1 - 

At t = 2, simultaneously, both providers can introduce private variants, i.e., 
ones in which users avoid targeted ads; we denote these by Pi. The providers can 
determine an associated "cost" that controls the utility of the private variants, 
with the goal of tuning the market share for each service they provide. We denote 
these costs by c,. The fraction of users that choose Pj at time t is given by pn- We 
have Y^i=o Si2 + J2j=iPj2 = 1- The fraction of users left using the non-private 
options (or neither option) at t = 2 is given by: 

Si2 = s»i(l - Fi{ci,c 2 )) for i = 0, 1,2. 

That is, F i (c 1 ,c 2 ) is the fraction of users who were using Si or were not using 
cither service but are now using one of the private variants. The users Sn — Sj2 
switching to a private variant are distributed among the two providers as follows: 



Here, flj(ci, c 2 ) is a function determining the split, among the competing private- 
service providers, of users switching to a private variant; note H\(c\,Oi) = 1 — 
^2(ci,c 2 ). Also, recall that p a = 0. 

Let Vi be the value that provider i derives from the standard service. Let jiVi 
be the value it derives from the private service, where ji € (0, 1]. Let denote 
the revenue function of provider i at the second stage of the game. We have: 

Ti = ViS i2 + v^ipa 
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(27) 



for i = 1,2. 

In equilibrium, neither provider can increase its revenue by unilaterally de- 
viating. The first-order conditions (FOC) are given by 

<g=0, fori = 1,2. (28) 

Let {£1,62} be a solution to this system of equations. Then, the second-order 
conditions (SOC) are given by: 

^(ci,c 2 ) <0, fori = 1,2. (29) 

Our questions revolve around the equilibrium of this game. 



4.1 A prisoners' dilemma 

The framework described above was designed to be very general; however, this 
makes it somewhat difficult to get a handle on the nature of the game. We 
consider a worked example in order to gain more insight. For simplicity, we will 
assume Fj = F for i = 0, 1, 2. There are certain natural properties that we want 
for the function F: F should be decreasing in the q, and F should go to as 
both Q go to infinity. We simply things further by assuming that, if either cost c, 
goes to 0, all users will prefer the zero-cost private option, and thus F will go to 
1. This may not be the case in all settings, but it is a reasonable and instructive 
place to start. 

A relatively straightforward function with these properties is 

if Ci = c 2 = 00, 

F(c 1 ,c 2 )=ll if ci = 0, or c 2 = 0, (30) 

^ exp ( — ) other wise. 

We define Hi so that the fraction that goes to Pi is proportional to its cost. 

if Ci = 00, 

H 1 (c 1 ,c 2 )={± ifci=C2 = 0, (31) 



C2 



otherwise. 



■ ci+c 2 

We define H 2 similarly. Also, for notational simplicity let sn — Sj. Under these 
assumptions, the payoff function for player 1 is: 

ri =vJ e ^^^±^+sX (32) 
y ci+c 2 J 

and similarly, for player 2. Note that the payoffs are continuous. Furthermore, 
under the assumption that Fi = F, the first and second derivatives of the revenue 
function assume the following forms: 

dn ( dF dHi^, . , ,dF\ 

^r Vi \ Sii ^ +li ^ F{ci > C2)+liHi{ci > C2) d^h (33) 



and 

4.2 Computation of equilibria 

We now assume that 7; > 0, i.e., that both players can derive some revenue 
from private users. 

Theorem 3. The game has two possible equilibria: 

1. at {c\ — 0, c\ = 0}, with fj = Viji/2, 

2. at {cj = 00, c* 2 — 00}, if Si > 7j, with r,- L — SjUj. 

Remark 2. Theorem [3] demonstrates how the Prisoners' Dilemma arises natu- 
rally in this two-player game. For example, if Sj = §74 for i = 1, 2, then, when 
neither provider offers a privacy option, their revenue is \^iVi. However, this 
is not an equilibrium point; at equilibrium, both players offer zero-cost privacy 
options, and their revenue is reduced to \^iVi. 

Proof. The proof proceeds in a sequence of lemmas. We begin by considering 
cases in which one player offers a free privacy option, while the other charges a 
(possibly infinite) cost. 

Lemma 2. The game does not admit solutions of the form {ci = 0, c_i > 0}. 

Proof. Because the game is symmetric, it suffices to consider the case in which 

l30|and[3"H we have 
27l the revenue for 



ci = 0, and C2 = c, for some constant c > 0. From Equations 
F(0,c) = 1, iii(0,c) = 1, and i? 2 (0,c) = 0. From Equation 
player 1 is r\ = fi7i, and for player 2 it is r-2 = 0. Suppose player 2 unilaterally 
deviates by playing c-i = 0. In this case, H 2 (0,0) = 1/2, and r 2 = W272/2. 
Therefore, because 72 > 0, C\ = 0, c 2 = c, does not constitute an equilibrium. 

□ 

Next, we consider settings in which both players offer the privacy option for 
a finite, non-zero cost. 

Lemma 3. The game does not admit solutions of the form {ci > 0, C-i > 0}. 
Proof. We consider candidate equilibria suggested by solutions to the FOC: 

F(c 1 ,C2) C2 " l(C2(Cl+ ^ ) ' Sl ' ( , C | +C2 + Cl)7l) =0 (35) 
(ci + c 2 ) 

„, , c lV2 (ci (ci + c 2 ) s 2 - (c 2 + ci + eg) 72) 

F(ci,c 2 ) ^—^ =0. (36) 

First, note that, because costs are finite, F(ci,c 2 ) > 0. Therefore, the FOC can 
be simplified to the following equivalent conditions: 

C2 (ci + C 2 ) Si - (Cj + C 2 + Ci) 71 = 0, (37) 

ci (ci + c 2 ) s 2 - (ci + ci + c 2 ) 72 = 0. (38) 



Solving the first equation above for c\ and substituting into the second one, we 
obtain the following solution: 

ci = — — — K, c 2 = A") , (39) 

S2 "72 si - 7i J 

where 

K= 71^2 + 72^1 - 27172 ^ (4Q) 

7l s 2 + 72^1 - 7172 ' 

Next, we need to check the SOC for this solution. A long sequence of calculations 
yields: 

TT72 4 

d 2 r 1 7f« x e -n^+^i-n) ( Sl - 7l ) (s 2 - 72) ( 7l s 2 + 72^1 - 7172) ^ n 

-^-(ci,c 2 ) = -g < 0, 

° c i (7i s 2 +72S1 - 27172) 

<9 2 r 2 . 7 | U2e "^i+^I^I7 ( S2 _ 72 ) ( Sl _ 7l ) 4 ( 7lS2 + 72Sl _ 7l72 ) 

7)^ (ci ' C2) = ? 7 o ^ < °' 

oc 2 ( 7lS2 + 72Sl - 2 7l 7 2 ) 

which can be further simplified to the equivalent conditions 

/ s 71^2 +72S1 -7i72 s i^7i^ n , AU 

(*i - 7i) <, = — r^- < 0, (41) 

7i«2 +72S1 - 27172 K 

I v 7l«2 +72S1 -7172 S 2 - 72 

( s 2 - 72) : s = — 7^- < 0. (42 

71S2 + 72«i - 27i7 2 K 



Notice that (si — ji)/K has the same sign as c\ in Equation 39 Similarly, 
(s 2 — 7 2 )/if has the same sign as c 2 . Because costs are non- negative, the second- 
order conditions are not met; this solution minimizes rather than maximizes the 
revenue of the players and is therefore not an equilibrium point. □ 

Next, we consider the case in which both players offer free privacy options. 

Lemma 4. Both players' offering free privacy options (i.e., C\ = c 2 = 0) con- 
stitutes an equilibrium of the game. 

Proof. In this case, users switch en masse to the private services and are dis- 
tributed equally between the two providers. The revenue for player i is Viji/2. 
Furthermore, if a player unilaterally deviates and switches to a non-zero cost for 
privacy, his revenue instantly collapses to zero. Therefore, C\ — c 2 = consti- 
tutes an equilibrium to the game. □ 

Finally, we consider the case in which neither player offers a privacy option. 

Lemma 5. Neither player's offering a privacy option (i.e., Cj = c 2 = 00) con- 
stitutes an equilibrium of the game if Sj < 7 j, for i = {1,2}. 

Proof. Suppose that neither player offers a privacy option; so r, = V{Si. Now, 
consider the case in which player 1 wishes to deviate unilaterally. (The case 
for player 2 can be argued identically.) First, note that lim C2 _ J . 00 F(ci, c 2 ) = 



exp(— ci), and lim C2 _ >00 H\(c\, C2) = 1. Therefore, if player 2 doesn't offer a 
privacy option, i.e., C2 = 00, player 1 deviates and plays C\ \ his new revenue will 
be 

r\ = si«i(l - exp(-ci)) + «i7i exp(-ci) = siui + «i exp(-ci)(7i - si). (43) 

If 71 < si, then player 1 cannot improve his position; therefore, not offering 
a privacy option constitutes an equilibrium. If 71 > s\, player 1 can increase 
his revenue by decreasing his cost; therefore, not offering a privacy option is 
not an equilibrium. (If 71 = 8%, player 1 cannot strictly improve his revenue by 
deviating, and we have a weak equilibrium.) □ 

This concludes the proof of Theorem [3j □ 

This example demonstrates what we see as the potentially natural outcomes 
of this two-player dynamic that would extend to three or more players as well. It 
is possible that no service provider is incentivized to offer a privacy option in this 
game. In such a setting, one might expect a new entrant to enter the "game" 
and disrupt the status quo by offering a suitable privacy option, potentially 
forcing other providers to do so as well. It is also possible that all competitors 
are inclined to offer a privacy option. In our example, this led to all users' opting 
to offer privacy, but we could have utilized arguably more realistic functions F to 
account for the fact that some users might find more value in not offering privacy 
or might find the cost of doing so non-trivial regardless of the efforts they exert 
to drive the cost down. Under such settings, we would expect other equilibria to 
arise; in our example, there were other points at which the first-order conditions 
but not the second-order conditions were met, but, more generally (for other 
functional relationships), we could have other equilibria. 

5 Conclusion 

The results of Sections [3] and [4] suggest that website operators could have their 
cake and eat it, too. By carefully controlling the cost to users of opting out of 
targeted ads, they could maximize their revenue and respect their users' privacy 
concerns. Putting this approach into practice would require surmounting at least 
two major obstacles. 

First, a service provider would need a good estimate of the parameter 7, i.e., 
the fraction of the revenue derived from a targeted user that can be derived 
from a private user. The value of 7 is closely related to the extent to which click- 
through and conversion rates are improved by various forms of ad targeting, 
which in turn is still the subject of intensive, ongoing research. 

Second, the service provider would need to translate the abstract "cost" a 
of our economic analysis into a concrete privacy-enforcement tool that can be 
installed and used at a cost of c,-. It may suffice to be able to choose between 
two technological options, one of which is clearly more costly to users than the 
other, but even this would be nontrivial given the state of the art of privacy 
enforcement. 
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